Static task
static1
Behavioral task
behavioral1
Sample
TCReloaded CSS v1/thec0re.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
TCReloaded CSS v1/thec0re.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
TCReloaded CSS v1/thec0re.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TCReloaded CSS v1/thec0re.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
TCReloaded CSS v1/thec0re.net - the next level.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
TCReloaded CSS v1/thec0re.net - the next level.url
Resource
win10v2004-20240412-en
General
-
Target
fc5dfb719bba32cd632cb614e3d44d78_JaffaCakes118
-
Size
163KB
-
MD5
fc5dfb719bba32cd632cb614e3d44d78
-
SHA1
c6d94e8f0940c8d722ac551855eea332f54030f7
-
SHA256
8a3c75b5361300ea92cf2eeb34aaa85dbf970ccf3f44596ea4ae32171765c9df
-
SHA512
3e8588eef78831bc41267cc67e84d3665d43949f0885314c6733ac3f4d0ec53774b40d6714fc4d1ead061672cc6b30d55f2af6081dabf7aa57d451d0fa3d42b6
-
SSDEEP
3072:SIi0pC0GUqF2QTiPWizMYFMTeHl+/85ifqLvJ2QXKV58l2U9GeuaaYCmPtfjCq3e:SKsUqFW+iztE69v1XKUQU9G9aaYCmP1Q
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/TCReloaded CSS v1/thec0re.dll unpack001/TCReloaded CSS v1/thec0re.exe
Files
-
fc5dfb719bba32cd632cb614e3d44d78_JaffaCakes118.rar
-
TCReloaded CSS v1/Info.txt
-
TCReloaded CSS v1/thec0re.dll.dll windows:4 windows x86 arch:x86
bb1083faffdba621fb401ff8aabdc650
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetAsyncKeyState
vstdlib
RandomSeed
tier0
Msg
Sections
.text Size: 105KB - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
TCReloaded CSS v1/thec0re.exe.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 49KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
TCReloaded CSS v1/thec0re.net - the next level.url